---
id: CVE-2026-7025
title: >-
  Typecho Ping Back Service Endpoint Service.php sendPingHandle server-side
  request forgery
summary: >-
  A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects
  the function Service::sendPingHandle of the file var/Widget/Service.php of the
  component Ping Back Service Endpoint. The manipulation of the argument
  X-Pingback…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-918
product: Typecho
affected:
  - Typecho 1.0
  - Typecho 1.1
  - Typecho 1.2
  - Typecho 1.3.0
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-27T13:11:52.275557Z'
exploitAvailable: true
published: '2026-04-26'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T13:30:00.271Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-7025'
references:
  - url: 'https://vuldb.com/vuln/359605'
    label: >-
      VDB-359605 | Typecho Ping Back Service Endpoint Service.php sendPingHandle
      server-side request forgery
  - url: 'https://vuldb.com/vuln/359605/cti'
    label: 'VDB-359605 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-7025'
    label: CVE-2026-7025 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/797772'
    label: 'Submit #797772 | Typecho 1.3.0 and earlier Server-Side Request Forgery'
  - url: 'https://wang1rrr.github.io/2026/03/04/CVE-Report-Typecho-v1-3-0-SSRF/'
  - url: >-
      https://github.com/typecho/typecho/commit/96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b
  - url: 'https://github.com/typecho/typecho/releases/tag/v1.3.1-rc'
  - url: 'https://github.com/typecho/typecho/'
tags:
  - cve.org
  - exploit-available
epss: 0.00278
epssPercentile: 0.20136
ingestedAt: '2026-10-27T16:11:59.348Z'
---

## Overview

A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 1.3.1-rc is able to resolve this issue. The patch is identified as 96ccfdda4fc1e66ca04a003bf0c71d25864e6a0b. Upgrading the affected component is advised.

## Affected

- `Typecho 1.0`
- `Typecho 1.1`
- `Typecho 1.2`
- `Typecho 1.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.